Skip to content

Commit 1cc23fd

Browse files
c00kiemon5terc00kiemon5ter
authored
Merge pull request #618 from abliqo/holder-of-key
Fix parsing of assertions with Holder-of-Key profile
2 parents 73215f6 + 477c440 commit 1cc23fd

File tree

7 files changed

+244
-17
lines changed

7 files changed

+244
-17
lines changed

‎.gitignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -114,6 +114,9 @@ venv.bak/
114114
# Rope project settings
115115
.ropeproject
116116

117+
# Visual Studio Code files
118+
.vscode/
119+
117120
# mkdocs documentation
118121
/site
119122

‎src/saml2/response.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -722,11 +722,11 @@ def _bearer_confirmed(self, data):
722722
return True
723723

724724
def _holder_of_key_confirmed(self, data):
725-
if not data:
725+
if not data or not data.extension_elements:
726726
return False
727727

728728
has_keyinfo = False
729-
for element in extension_elements_to_elements(data,
729+
for element in extension_elements_to_elements(data.extension_elements,
730730
[samlp, saml, xenc, ds]):
731731
if isinstance(element, ds.KeyInfo):
732732
has_keyinfo = True

‎tests/saml2_data.py‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -123,6 +123,36 @@
123123
</SubjectConfirmation>
124124
"""
125125

126+
TEST_HOLDER_OF_KEY_SUBJECT_CONFIRMATION = """<?xml version="1.0" encoding="utf-8"?>
127+
<SubjectConfirmation
128+
Method="urn:oasis:names:tc:SAML:2.0:cm:holder-of-key"
129+
xmlns="urn:oasis:names:tc:SAML:2.0:assertion">
130+
<SubjectConfirmationData
131+
InResponseTo="responseID"
132+
NotOnOrAfter="2007-09-14T01:05:02Z"
133+
Recipient="recipient">
134+
<KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
135+
<X509Data xmlns="http://www.w3.org/2000/09/xmldsig#">
136+
<X509Certificate xmlns="http://www.w3.org/2000/09/xmldsig#">
137+
MIICITCCAYoCAQEwDQYJKoZIhvcNAQELBQAwWDELMAkGA1UEBhMCenoxCzAJBgNV
138+
BAgMAnp6MQ0wCwYDVQQHDAR6enp6MQ4wDAYDVQQKDAVaenp6ejEOMAwGA1UECwwF
139+
Wnp6enoxDTALBgNVBAMMBHRlc3QwIBcNMTkwNDEyMTk1MDM0WhgPMzAxODA4MTMx
140+
OTUwMzRaMFgxCzAJBgNVBAYTAnp6MQswCQYDVQQIDAJ6ejENMAsGA1UEBwwEenp6
141+
ejEOMAwGA1UECgwFWnp6enoxDjAMBgNVBAsMBVp6enp6MQ0wCwYDVQQDDAR0ZXN0
142+
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDHcj80WU/XBsd9FlyQmfjPUdfm
143+
edhCFDd6TEQmZNNqP/UG+VkGa+BXjRIHMfic/WxPTbGhCjv68ci0UDNomUXagFex
144+
LGNpkwa7+CRVtoc/1xgq+ySE6M4nhcCutScoxNvWNn5eSQ66i3U0sTv91MgsXxqE
145+
dTaiZg0BIufEc3dueQIDAQABMA0GCSqGSIb3DQEBCwUAA4GBAGUV5B+USHvaRa8k
146+
gCNJSuNpo6ARlv0ekrk8bbdNRBiEUdCMyoGJFfuM9K0zybX6Vr25wai3nvaog294
147+
Vx/jWjX2g5SDbjItH6VGy6C9GCGf1A07VxFRCfJn5tA9HuJjPKiE+g/BmrV5N4Ce
148+
alzFxPHWYkNOzoRU8qI7OqUai1kL
149+
</X509Certificate>
150+
</X509Data>
151+
</KeyInfo>
152+
</SubjectConfirmationData>
153+
</SubjectConfirmation>
154+
"""
155+
126156
TEST_SUBJECT = """<?xml version="1.0" encoding="utf-8"?>
127157
<Subject xmlns="urn:oasis:names:tc:SAML:2.0:assertion">
128158
<NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"

‎tests/saml_hok.xml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
<?xml version='1.0' encoding='UTF-8'?>
2+
<!-- SAML response with multiple 'holder-of-key' subject confirmations. -->
3+
<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol"
4+
xmlns:ns1="urn:oasis:names:tc:SAML:2.0:assertion"
5+
xmlns:ns2="http://www.w3.org/2000/09/xmldsig#"
6+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Destination="https://sp:443/.auth/saml/login" ID="_df9a1eadc90519252694519504a13dfb8dd67a1bb4" InResponseTo="id-KHlas49TtW2VdC8WN" IssueInstant="2019-05-14T20:35:13Z" Version="2.0">
7+
<ns1:Issuer>https://idp:8443</ns1:Issuer>
8+
<ns0:Status>
9+
<ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" />
10+
</ns0:Status>
11+
<ns1:Assertion ID="_12d211a5015f71eba8f837d2aa8b95b28bbdc4599b" IssueInstant="2019-05-14T20:35:13Z" Version="2.0">
12+
<ns1:Issuer>https://idp:8443</ns1:Issuer>
13+
<ns1:Subject>
14+
<ns1:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent">57a0a35eefdb29ca8b4ab78d5a118117</ns1:NameID>
15+
<ns1:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:holder-of-key">
16+
<ns1:SubjectConfirmationData InResponseTo="id-KHlas49TtW2VdC8WN" NotOnOrAfter="2019-05-14T20:36:13Z" Recipient="https://sp:443/.auth/saml/login">
17+
<ns2:KeyInfo>
18+
<ns2:X509Data>
19+
<ns2:X509Certificate>MIICITCCAYoCAQEwDQYJKoZIhvcNAQELBQAwWDELMAkGA1UEBhMCenoxCzAJBgNVBAgMAnp6MQ0wCwYDVQQHDAR6enp6MQ4wDAYDVQQKDAVaenp6ejEOMAwGA1UECwwFWnp6enoxDTALBgNVBAMMBHRlc3QwIBcNMTkwNDEyMTk1MDM0WhgPMzAxODA4MTMxOTUwMzRaMFgxCzAJBgNVBAYTAnp6MQswCQYDVQQIDAJ6ejENMAsGA1UEBwwEenp6ejEOMAwGA1UECgwFWnp6enoxDjAMBgNVBAsMBVp6enp6MQ0wCwYDVQQDDAR0ZXN0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDHcj80WU/XBsd9FlyQmfjPUdfmedhCFDd6TEQmZNNqP/UG+VkGa+BXjRIHMfic/WxPTbGhCjv68ci0UDNomUXagFexLGNpkwa7+CRVtoc/1xgq+ySE6M4nhcCutScoxNvWNn5eSQ66i3U0sTv91MgsXxqEdTaiZg0BIufEc3dueQIDAQABMA0GCSqGSIb3DQEBCwUAA4GBAGUV5B+USHvaRa8kgCNJSuNpo6ARlv0ekrk8bbdNRBiEUdCMyoGJFfuM9K0zybX6Vr25wai3nvaog294Vx/jWjX2g5SDbjItH6VGy6C9GCGf1A07VxFRCfJn5tA9HuJjPKiE+g/BmrV5N4CealzFxPHWYkNOzoRU8qI7OqUai1kL</ns2:X509Certificate>
20+
</ns2:X509Data>
21+
</ns2:KeyInfo>
22+
</ns1:SubjectConfirmationData>
23+
</ns1:SubjectConfirmation>
24+
<ns1:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:holder-of-key">
25+
<ns1:SubjectConfirmationData InResponseTo="id-KHlas49TtW2VdC8WN" NotOnOrAfter="2019-05-14T20:36:13Z" Recipient="https://sp:443/.auth/saml/login">
26+
<ns2:KeyInfo>
27+
<ns2:X509Data>
28+
<ns2:X509Certificate>MIICITCCAYoCAQEwDQYJKoZIhvcNAQELBQAwWDELMAkGA1UEBhMCenoxCzAJBgNVBAgMAnp6MQ0wCwYDVQQHDAR6enp6MQ4wDAYDVQQKDAVaenp6ejEOMAwGA1UECwwFWnp6enoxDTALBgNVBAMMBHRlc3QwIBcNMTkwNDEyMTk1MDM0WhgPMzAxODA4MTMxOTUwMzRaMFgxCzAJBgNVBAYTAnp6MQswCQYDVQQIDAJ6ejENMAsGA1UEBwwEenp6ejEOMAwGA1UECgwFWnp6enoxDjAMBgNVBAsMBVp6enp6MQ0wCwYDVQQDDAR0ZXN0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDjW0kJM+4baWKtvO24ZsGXNvNKKkwTMz7OW5Z6BRqhSOq2WA0c5NCpMk6rD8Z2OTFEolPojEjf8dVyd/Ds/hrjFKQv8wQgbdXLN51YTIsgd6h+hBJO+vzhl0PT4aT7M0JKo5ALtS6qk4tsworW2BnwyvsGSAinwfeWt4t/b1J3kwIDAQABMA0GCSqGSIb3DQEBCwUAA4GBAFtj7WArQQBugmh/KQjjlfTQ5A052QeXfgTyO9vv1S6MRIi7qgiaEv49cGXnJv/TWbySkMKObPMUApjg6z8PqcxuShew5FCTkNvwhABFPiyu0fUj3e2FEPHfsBu76jz4ugtmhUqjqhzwFY9ctnWRkkl6J0AjM3LnHOSgjNIclDZG</ns2:X509Certificate>
29+
</ns2:X509Data>
30+
</ns2:KeyInfo>
31+
</ns1:SubjectConfirmationData>
32+
</ns1:SubjectConfirmation>
33+
</ns1:Subject>
34+
<ns1:AuthnStatement AuthnInstant="2019-05-14T20:35:13Z" SessionIndex="1">
35+
<ns1:AuthnContext>
36+
<ns1:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</ns1:AuthnContextClassRef>
37+
</ns1:AuthnContext>
38+
</ns1:AuthnStatement>
39+
<ns1:AttributeStatement>
40+
<ns1:Attribute Name="uid" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
41+
<ns1:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xsi:type="xs:string">testuser</ns1:AttributeValue>
42+
</ns1:Attribute>
43+
</ns1:AttributeStatement>
44+
</ns1:Assertion>
45+
</ns0:Response>

‎tests/saml_hok_invalid.xml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
<?xml version='1.0' encoding='UTF-8'?>
2+
<!-- SAML response with invalid 'holder-of-key' SubjectConfirmation: missing KeyInfo element. -->
3+
<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol"
4+
xmlns:ns1="urn:oasis:names:tc:SAML:2.0:assertion"
5+
xmlns:ns2="http://www.w3.org/2000/09/xmldsig#"
6+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Destination="https://sp:443/.auth/saml/login" ID="_df9a1eadc90519252694519504a13dfb8dd67a1bb4" InResponseTo="id-KHlas49TtW2VdC8WN" IssueInstant="2019-05-14T20:35:13Z" Version="2.0">
7+
<ns1:Issuer>https://idp:8443</ns1:Issuer>
8+
<ns0:Status>
9+
<ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" />
10+
</ns0:Status>
11+
<ns1:Assertion ID="_12d211a5015f71eba8f837d2aa8b95b28bbdc4599b" IssueInstant="2019-05-14T20:35:13Z" Version="2.0">
12+
<ns1:Issuer>https://idp:8443</ns1:Issuer>
13+
<ns1:Subject>
14+
<ns1:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent">57a0a35eefdb29ca8b4ab78d5a118117</ns1:NameID>
15+
<ns1:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:holder-of-key">
16+
<ns1:SubjectConfirmationData InResponseTo="id-KHlas49TtW2VdC8WN" NotOnOrAfter="2019-05-14T20:36:13Z" Recipient="https://sp:443/.auth/saml/login" />
17+
</ns1:SubjectConfirmation>
18+
</ns1:Subject>
19+
<ns1:AuthnStatement AuthnInstant="2019-05-14T20:35:13Z" SessionIndex="1">
20+
<ns1:AuthnContext>
21+
<ns1:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</ns1:AuthnContextClassRef>
22+
</ns1:AuthnContext>
23+
</ns1:AuthnStatement>
24+
<ns1:AttributeStatement>
25+
<ns1:Attribute Name="uid" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
26+
<ns1:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xsi:type="xs:string">testuser</ns1:AttributeValue>
27+
</ns1:Attribute>
28+
</ns1:AttributeStatement>
29+
</ns1:Assertion>
30+
</ns0:Response>

‎tests/test_02_saml.py‎

Lines changed: 41 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -867,35 +867,61 @@ def testAccessors(self):
867867
self.sc.subject_confirmation_data = saml.subject_confirmation_data_from_string(
868868
saml2_data.TEST_SUBJECT_CONFIRMATION_DATA)
869869
new_sc = saml.subject_confirmation_from_string(self.sc.to_string())
870-
assert new_sc.name_id.sp_provided_id == "sp provided id"
871-
assert new_sc.method == saml.SCM_BEARER
872-
assert new_sc.subject_confirmation_data.not_before == \
873-
"2007-08-31T01:05:02Z"
874-
assert new_sc.subject_confirmation_data.not_on_or_after == \
875-
"2007-09-14T01:05:02Z"
876-
assert new_sc.subject_confirmation_data.recipient == "recipient"
877-
assert new_sc.subject_confirmation_data.in_response_to == "responseID"
878-
assert new_sc.subject_confirmation_data.address == "127.0.0.1"
879-
880-
def testUsingTestData(self):
881-
"""Test subject_confirmation_from_string() using test data"""
870+
self._assertBearer(new_sc)
882871

872+
def testBearerUsingTestData(self):
873+
"""Test subject_confirmation_from_string() using test data for 'bearer' SubjectConfirmation"""
883874
sc = saml.subject_confirmation_from_string(
884875
saml2_data.TEST_SUBJECT_CONFIRMATION)
876+
assert sc.verify()
877+
self._assertBearer(sc)
878+
879+
def _assertBearer(self, sc):
880+
"""Asserts SubjectConfirmation that has method 'bearer'"""
885881
assert sc.name_id.sp_provided_id == "sp provided id"
886882
assert sc.method == saml.SCM_BEARER
883+
assert sc.subject_confirmation_data is not None
887884
assert sc.subject_confirmation_data.not_before == "2007-08-31T01:05:02Z"
888885
assert sc.subject_confirmation_data.not_on_or_after == "2007-09-14T01:05:02Z"
889886
assert sc.subject_confirmation_data.recipient == "recipient"
890887
assert sc.subject_confirmation_data.in_response_to == "responseID"
891888
assert sc.subject_confirmation_data.address == "127.0.0.1"
889+
key_info = sc.subject_confirmation_data.extensions_as_elements(ds.KeyInfo.c_tag, ds)
890+
assert len(key_info) == 0
892891

893-
def testVerify(self):
894-
"""Test SubjectConfirmation verify"""
892+
def testHolderOfKeyUsingTestData(self):
893+
"""Test subject_confirmation_from_string() using test data for 'holder-of-key' SubjectConfirmation"""
895894

896895
sc = saml.subject_confirmation_from_string(
897-
saml2_data.TEST_SUBJECT_CONFIRMATION)
896+
saml2_data.TEST_HOLDER_OF_KEY_SUBJECT_CONFIRMATION
897+
)
898898
assert sc.verify()
899+
assert sc.method == saml.SCM_HOLDER_OF_KEY
900+
assert sc.subject_confirmation_data is not None
901+
assert sc.subject_confirmation_data.not_on_or_after == "2007-09-14T01:05:02Z"
902+
assert sc.subject_confirmation_data.recipient == "recipient"
903+
assert sc.subject_confirmation_data.in_response_to == "responseID"
904+
905+
key_info = sc.subject_confirmation_data.extensions_as_elements(ds.KeyInfo.c_tag, ds)
906+
assert len(key_info) == 1
907+
assert len(key_info[0].x509_data) == 1
908+
909+
expected_cert = (
910+
"MIICITCCAYoCAQEwDQYJKoZIhvcNAQELBQAwWDELMAkGA1UEBhMCenoxCzAJBgNV"
911+
"BAgMAnp6MQ0wCwYDVQQHDAR6enp6MQ4wDAYDVQQKDAVaenp6ejEOMAwGA1UECwwF"
912+
"Wnp6enoxDTALBgNVBAMMBHRlc3QwIBcNMTkwNDEyMTk1MDM0WhgPMzAxODA4MTMx"
913+
"OTUwMzRaMFgxCzAJBgNVBAYTAnp6MQswCQYDVQQIDAJ6ejENMAsGA1UEBwwEenp6"
914+
"ejEOMAwGA1UECgwFWnp6enoxDjAMBgNVBAsMBVp6enp6MQ0wCwYDVQQDDAR0ZXN0"
915+
"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDHcj80WU/XBsd9FlyQmfjPUdfm"
916+
"edhCFDd6TEQmZNNqP/UG+VkGa+BXjRIHMfic/WxPTbGhCjv68ci0UDNomUXagFex"
917+
"LGNpkwa7+CRVtoc/1xgq+ySE6M4nhcCutScoxNvWNn5eSQ66i3U0sTv91MgsXxqE"
918+
"dTaiZg0BIufEc3dueQIDAQABMA0GCSqGSIb3DQEBCwUAA4GBAGUV5B+USHvaRa8k"
919+
"gCNJSuNpo6ARlv0ekrk8bbdNRBiEUdCMyoGJFfuM9K0zybX6Vr25wai3nvaog294"
920+
"Vx/jWjX2g5SDbjItH6VGy6C9GCGf1A07VxFRCfJn5tA9HuJjPKiE+g/BmrV5N4Ce"
921+
"alzFxPHWYkNOzoRU8qI7OqUai1kL"
922+
)
923+
xcert = key_info[0].x509_data[0].x509_certificate
924+
assert xcert.text.strip().replace("\n", "") == expected_cert
899925

900926

901927
class TestSubject:

‎tests/test_93_hok.py‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
#!/usr/bin/env python
2+
# -*- coding: utf-8 -*-
3+
from pathutils import dotname, full_path
4+
5+
from pytest import raises
6+
7+
from saml2 import xmldsig as ds
8+
from saml2.config import config_factory
9+
from saml2.response import VerificationError
10+
from saml2.response import authn_response
11+
12+
13+
HOLDER_OF_KEY_RESPONSE_FILE = full_path("saml_hok.xml")
14+
INVALID_HOLDER_OF_KEY_RESPONSE_FILE = full_path("saml_hok_invalid.xml")
15+
16+
17+
class TestHolderOfKeyResponse:
18+
def test_valid_hok_response_is_parsed(self):
19+
"""Verifies that response with 'holder-of-key' subject confirmations is parsed successfully."""
20+
resp = self._get_test_response(HOLDER_OF_KEY_RESPONSE_FILE)
21+
resp.do_not_verify = True
22+
resp.parse_assertion()
23+
assert resp.get_subject() is not None
24+
assert len(resp.assertion.subject.subject_confirmation) == 2
25+
26+
actual_hok_certs = [
27+
ki.x509_data[0].x509_certificate.text.strip()
28+
for sc in resp.assertion.subject.subject_confirmation
29+
for ki in sc.subject_confirmation_data.extensions_as_elements(
30+
ds.KeyInfo.c_tag, ds
31+
)
32+
]
33+
assert actual_hok_certs == self._expected_hok_certs()
34+
35+
def _expected_hok_certs(self):
36+
certs = [
37+
(
38+
"MIICITCCAYoCAQEwDQYJKoZIhvcNAQELBQAwWDELMAkGA1UEBhMCenoxCzAJBgNV"
39+
"BAgMAnp6MQ0wCwYDVQQHDAR6enp6MQ4wDAYDVQQKDAVaenp6ejEOMAwGA1UECwwF"
40+
"Wnp6enoxDTALBgNVBAMMBHRlc3QwIBcNMTkwNDEyMTk1MDM0WhgPMzAxODA4MTMx"
41+
"OTUwMzRaMFgxCzAJBgNVBAYTAnp6MQswCQYDVQQIDAJ6ejENMAsGA1UEBwwEenp6"
42+
"ejEOMAwGA1UECgwFWnp6enoxDjAMBgNVBAsMBVp6enp6MQ0wCwYDVQQDDAR0ZXN0"
43+
"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDHcj80WU/XBsd9FlyQmfjPUdfm"
44+
"edhCFDd6TEQmZNNqP/UG+VkGa+BXjRIHMfic/WxPTbGhCjv68ci0UDNomUXagFex"
45+
"LGNpkwa7+CRVtoc/1xgq+ySE6M4nhcCutScoxNvWNn5eSQ66i3U0sTv91MgsXxqE"
46+
"dTaiZg0BIufEc3dueQIDAQABMA0GCSqGSIb3DQEBCwUAA4GBAGUV5B+USHvaRa8k"
47+
"gCNJSuNpo6ARlv0ekrk8bbdNRBiEUdCMyoGJFfuM9K0zybX6Vr25wai3nvaog294"
48+
"Vx/jWjX2g5SDbjItH6VGy6C9GCGf1A07VxFRCfJn5tA9HuJjPKiE+g/BmrV5N4Ce"
49+
"alzFxPHWYkNOzoRU8qI7OqUai1kL"
50+
),
51+
(
52+
"MIICITCCAYoCAQEwDQYJKoZIhvcNAQELBQAwWDELMAkGA1UEBhMCenoxCzAJBgNV"
53+
"BAgMAnp6MQ0wCwYDVQQHDAR6enp6MQ4wDAYDVQQKDAVaenp6ejEOMAwGA1UECwwF"
54+
"Wnp6enoxDTALBgNVBAMMBHRlc3QwIBcNMTkwNDEyMTk1MDM0WhgPMzAxODA4MTMx"
55+
"OTUwMzRaMFgxCzAJBgNVBAYTAnp6MQswCQYDVQQIDAJ6ejENMAsGA1UEBwwEenp6"
56+
"ejEOMAwGA1UECgwFWnp6enoxDjAMBgNVBAsMBVp6enp6MQ0wCwYDVQQDDAR0ZXN0"
57+
"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDjW0kJM+4baWKtvO24ZsGXNvNK"
58+
"KkwTMz7OW5Z6BRqhSOq2WA0c5NCpMk6rD8Z2OTFEolPojEjf8dVyd/Ds/hrjFKQv"
59+
"8wQgbdXLN51YTIsgd6h+hBJO+vzhl0PT4aT7M0JKo5ALtS6qk4tsworW2BnwyvsG"
60+
"SAinwfeWt4t/b1J3kwIDAQABMA0GCSqGSIb3DQEBCwUAA4GBAFtj7WArQQBugmh/"
61+
"KQjjlfTQ5A052QeXfgTyO9vv1S6MRIi7qgiaEv49cGXnJv/TWbySkMKObPMUApjg"
62+
"6z8PqcxuShew5FCTkNvwhABFPiyu0fUj3e2FEPHfsBu76jz4ugtmhUqjqhzwFY9c"
63+
"tnWRkkl6J0AjM3LnHOSgjNIclDZG"
64+
),
65+
]
66+
return certs
67+
68+
def test_invalid_hok_response_fails_verification(self):
69+
"""Verifies that response with invalid 'holder-of-key' subject confirmations is parsed successfully."""
70+
resp = self._get_test_response(INVALID_HOLDER_OF_KEY_RESPONSE_FILE)
71+
resp.do_not_verify = True
72+
73+
with raises(VerificationError):
74+
resp.parse_assertion()
75+
76+
def _get_test_response(self, path):
77+
conf = config_factory("idp", dotname("server_conf"))
78+
resp = authn_response(
79+
conf,
80+
"https://sp:443/.auth/saml/login",
81+
asynchop=False,
82+
allow_unsolicited=True,
83+
)
84+
with open(path, "r") as fp:
85+
authn_response_xml = fp.read()
86+
resp.loads(authn_response_xml, False)
87+
return resp
88+
89+
90+
if __name__ == "__main__":
91+
t = TestHolderOfKeyResponse()
92+
t.setup_class()
93+
t.test_hok_response_is_parsed()

0 commit comments

Comments
 (0)